I have a managed package that includes a connected app. After installation Subscribers add users to a permission set to access the connected app. When the users object the canvas app within the package they get authenticated into an external web application.
Part of that authentication process passes over a valid Salesforce SessionId and serverURL for use with the Partner API. As long as the users Profile has "API Access" this has been working well.
One subscriber has been reporting that users with a couple of profiles are unable to access the connected app. It starts to load, and then fails when attempting to call the Partner API.
The logging shows the response from the Partner API to a
getUserInfo() as being:
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:sf="urn:fault.partner.soap.sforce.com" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <soapenv:Body> <soapenv:Fault> <faultcode>sf:INSUFFICIENT_ACCESS</faultcode> <faultstring>INSUFFICIENT_ACCESS: null</faultstring> <detail> <sf:UnexpectedErrorFault xsi:type="sf:UnexpectedErrorFault"> <sf:exceptionCode>INSUFFICIENT_ACCESS</sf:exceptionCode> <sf:exceptionMessage/> </sf:UnexpectedErrorFault> </detail> </soapenv:Fault> </soapenv:Body> </soapenv:Envelope>
Temporarily moving the affected users to other profiles avoids the issue and the API calls can be made successfully.
The problem profile definitely has "API Access" enabled.
What could be preventing users with certain profiles from accessing the API even though they have access?